Attest402 captures a public web or API response and returns a cryptographically signed, RFC-3161-timestamped evidence package that verifies fully offline. Pay per call with x402 — no account, no API key. Built for AI agents.
Your agent made a decision based on an API response. Prove what that response actually was — attach the evidence package to the audit log.
Prices, terms, availability, published statements: capture the exact bytes served at a moment in time, with an independent timestamp.
Anyone can verify the Ed25519 signature and hashes offline with ~30 lines of code. You don't have to trust Attest402 after the fact.
POST a public HTTPS URL to /v1/attest. The response is HTTP 402 with x402 payment requirements.
Any x402 client (x402-fetch, Python SDK, MCP) signs the payment automatically. Settlement only happens after a successful capture.
Download the evidence package (zip) and keep it — it verifies offline forever against the published public keys.
# any x402-enabled HTTP client — payment handled automatically
POST https://attest402.com/v1/attest
{
"url": "https://api.example.com/prices/btc",
"externalReference": "agent-job-18492",
"includeTrustedTimestamp": true
}
# → 200 OK
{
"attestationId": "attest_9f8a1b2c3d4e",
"observedAt": "2026-08-01T19:50:00.123Z",
"httpStatus": 200,
"bodyHash": "sha256:e3b0c442...",
"attestation": { "algorithm": "Ed25519", "signature": "base64:..." },
"trustedTimestamp": { "type": "RFC3161", "status": "VALID" },
"evidencePackageUrl": "https://attest402.com/v1/evidence/attest_9f8a1b2c3d4e"
}| Endpoint | Method | Price | Function |
|---|---|---|---|
/v1/attest | POST | 0.20 USDC | Create a signed evidence package |
/v1/verify | POST | free | Verify an attestation (+ optional body) |
/v1/verify/{id} | GET | free | Attestation metadata |
/v1/evidence/{id} | GET | free | Download evidence package (24 h) |
/.well-known/attest-keys.json | GET | free | Ed25519 public keys (old keys stay available) |
/llms.txt | GET | free | Agent-readable service description |
Limits: GET only · public HTTPS only · max 3 redirects · max 2 MB · 10 s timeout · no logins, cookies, JS rendering or screenshots. Evidence packages are retained 24 hours, metadata 90 days — store the package yourself for long-term custody.
attestation.json # canonical signed record + signature + public key
response-body.bin # the exact bytes received
response-headers.json # captured response headers
redirect-chain.json # every redirect hop
timestamp-token.tsr # independent RFC-3161 timestamp token (DER)
verification-instructions.txt # step-by-step offline verification
Pipeline: Canonical JSON → SHA-256 → Ed25519 signature → RFC-3161 timestamp.
Verify offline with any Ed25519 implementation — no call to attest402.com needed.